Global ExtAuthz authPolicy.context not setting grpc initial_metadata

[prodion23]

What steps did you take and what happened:
Follow this guide: https://projectcontour.io/docs/1.25/guides/external-authorization/

This was my globalExtAuth config:

contour.yaml: |
    disablePermitInsecure: false
    globalExtAuth:
      extensionService: service/my-ext-authz
      failOpen: true
      authPolicy:
        disabled: false
        context:
          "my-module-name": "envoy"
          "my-service-name": "contour"
          "test": "test"
      responseTimeout: 200ms
      withRequestBody:
        maxRequestBytes: 10240
        packAsBytes: true
        allowPartialMessage: true

However, when the ext_authz filter config is propagated to envoy, it doesn't include the context as metadata/headers:

From the envoy logs:

[2025-05-09 22:34:01.445][1][debug][config] [source/common/listener_manager/listener_manager_impl.cc:106]   config: 
...
{"name":"envoy.filters.http.ext_authz","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz","grpc_service":

{"envoy_grpc":{"cluster_name":"extension/service/my-ext-authz","authority":"extension.service.my-ext-authz"}},"failure_mode_allow":true,"with_request_body":

{"max_request_bytes":10240,"allow_partial_message":true,"pack_as_bytes":true},"clear_route_cache":true,"status_on_error":{"code":"Forbidden"},"include_peer_certificate":true,"transport_api_version":"V3"}},{"name":"router","typed_config":

{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"http_protocol_options":{"accept_http_10":true,"allow_chunked_length":true},"access_log":

[{"name":"envoy.access_loggers.file","typed_config":

{"@type":"type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog","path":"/dev/stdout"}}],"use_remote_address":true,"normalize_path":true,"preserve_external_request_id":true,"merge_slashes":true,"common_http_protocol_options":{"idle_timeout":"60s"}}

What did you expect to happen:
I expected the envoy ext_authz filter to include an initial_metadata field that contained the globalExtAuthz.authPolicy.context key/value pairs.

I thought based on the field description:

Context is a set of key/value pairs that are sent to the authentication server in the check request. If a context is provided at an enclosing scope, the entries are merged such that the inner scope overrides matching keys from the outer scope.

That maybe they wouldn't appear in the ext_auth config but somehow get sent another way, but on my ext_authz server those headers weren't present on the request.

Environment:

• Contour version: v1.30.3
• Kubernetes version: (use kubectl version): v1.30.5
• Kubernetes installer & version: Docker desktop for mac
• Cloud provider or hardware configuration:
• OS (e.g. from /etc/os-release):

[github-actions]

Hey @prodion23! Thanks for opening your first issue. We appreciate your contribution and welcome you to our community! We are glad to have you here and to have your input on Contour. You can also join us on our mailing list and in our channel in the Kubernetes Slack Workspace

[prodion23]

This is an example of the payload I see on my ext-authz server, notice how the authPolicy.context key/values are not present in the headers or the check request payload.

Check called
gRPC Metadata (AuthV3 headers):
  :authority: extension.my-service.my-ext-authz
  x-envoy-internal: true
  content-type: application/grpc
  x-forwarded-for: 10.1.0.123
  x-envoy-expected-rq-timeout-ms: 200

Body:

CheckRequest JSON:
{
  "attributes":  {
    "source":  {
      "address":  {
        "socketAddress":  {
          "address":  "192.168.65.3",
          "portValue":  58562
        }
      }
    },
    "destination":  {
      "address":  {
        "socketAddress":  {
          "address":  "10.1.0.123",
          "portValue":  8080
        }
      }
    },
    "request":  {
      "time":  "2025-05-19T18:21:27.757143Z",
      "http":  {
        "id":  "4326647315998961482",
        "method":  "POST",
        "headers":  {
          ":authority":  "localhost",
          ":method":  "POST",
          ":path":  "/post",
          ":scheme":  "http",
          "accept":  "*/*",
          "content-length":  "2",
          "content-type":  "application/json",
          "cookie":  "connect.sid=s%3ABqCPf67-89HCvXn1u-EMX760SjeDcLYN.4YcEiDyg%2FsNBTnAbfB%2BpAG9HZoDMwNW%2BJ7MTgnNm9h8",
          "user-agent":  "insomnia/10.3.0",
          "x-envoy-auth-partial-body":  "false",
          "x-envoy-external-address":  "192.168.65.3",
          "x-forwarded-for":  "192.168.65.3",
          "x-forwarded-proto":  "http",
          "x-request-id":  "81f72c3d-223c-477c-90c0-8c667e3c4e03"
        },
        "path":  "/post",
        "host":  "localhost",
        "scheme":  "http",
        "size":  "2",
        "protocol":  "HTTP/1.1",
        "rawBody":  "e30="
      }
    },
    "metadataContext":  {},
    "routeMetadataContext":  {}
  }
}